Methods and apparatus for application isolation

ABSTRACT

Processor(s) for detecting malicious software. A hardware virtual machine monitor (HVMM) operates under a host OS. Container(s) initialized with network application template(s) operate under a guest OS VM. A detection module operates under the guest OS VM includes a trigger detection module, a logging module and a container command module. The trigger detection module monitors activity on container(s) for a trigger event. The logging module writes activity report(s) in response to trigger event(s). The container command module issues command(s) in response to trigger event(s). The command(s) include a container start, stop and revert commands. A virtual machine control console operates under the host OS and starts/stops the HVMM. A container control module operates under the guest OSVM and controls container(s) in response to the command(s). The server communication module sends activity report(s) to a central collection network appliance that maintains a repository of activities for infected devices.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.15/459,563, entitled “Methods and Apparatus for Application Isolation,”filed Mar. 15, 2017, now U.S. Pat. No. 9,871,812, which is acontinuation of U.S. patent application Ser. No. 14/808,681, entitled“Methods and Apparatus for Application Isolation,” filed Jul. 24, 2015,now U.S. Pat. No. 9,602,524, which is a continuation of U.S. patentapplication Ser. No. 12/558,841, entitled “Methods and Apparatus forApplication Isolation,” filed Sep. 14, 2009, now U.S. Pat. No.9,098,698, which claims the benefit of U.S. Provisional Application No.61/096,591, filed Sep. 12, 2008, entitled “Large-Scale DistributedSensor for Detecting Malicious Web Sites via a Virtualized Web Browser,”each of which is incorporated herein by reference in its entirety.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

This invention was made with government support under Grant NumberW31P4Q-07-C-0244 awarded by Defense Advanced Research Projects Agency(DARPA). The government has certain rights in the invention.

BACKGROUND

Due to their enormous code-base, client side network applications havebecome a significant risk to the operating system and their users.Unfortunately, signature based antivirus and intrusion detection systemsare ineffective in preventing new attacks. In addition, currentapplication sandboxing mechanisms are either not strong enough or hardto deploy to the end user's desktop.

Currently, network applications have become the new attack vector posingsignificant risk to end-user's computing environment. These applicationsincreasingly operate on untrusted sources of data and code. For example,a typical user uses a web browser for multiple tasks such as: readingnews, performing on-line banking, shopping on-line or playing on-linegames, all in the same session. If any of the web sites visited by theuser hosts malicious software, the web browser or the user's computermay become compromised. Once compromised, the user may lose control to amalicious remote controller who can use the computer as he wishes.Typical cases of malware can transform the infected computer into aremotely controlled bot as part of a larger bot collective. Spam,hosting malicious software, stealing personal and sensitive dataincluding user IDs and passwords for banking sites are just a few amongmany observed uses of infected machines.

This kind of attack is called an intra-application attack because ituses just one application. Cross-site scripting attacks belong to thisclass and one recent example happened on Gmail. Drive-by downloading isanother common intra-application attack for web browsers, andresearchers from Google have found many malicious URLs containingdrive-by downloads on the Internet.

Another kind of attack is inter-application attacks which utilizes morethan one application. In this case, the attacker can put the maliciouscontent in a video file and allure the user to open it. Since WindowsMedia player uses Internet Explorer (IE) as the browser, even if theuser installed Firefox as the default browser, the malicious video filecan exploit the vulnerabilities of IE without the user's knowledge.

Standard defenses against these Internet-borne attacks employ antivirussoftware, personal firewalls, spyware detectors, and intrusion detectionsystems. Anti-virus software and IDSs are normally signature based andcan detect known attacks. However, they are inefficient in detecting newattacks and dealing with polymorphic viruses. Personal firewalls aresusceptible to being disabled by kernel-level rootkits.

Sandboxing is another method to protect the end user's computer.Different levels of sandboxing are feasible, ranging from languagesoftware fault isolation, process level system call mediation, tohardware virtualization. Unfortunately, language and process levelsandboxing are susceptible to bypass, and current hardwarevirtualization sandboxing, such as the Tahoma system, separates theapplications as well as the data that they usually share, thereforesacrificing usability. In addition, the Tahoma browser needs help fromthe web server, only protects the browser applications and is hard todeploy.

What is needed is a clean and isolated environment for instances ofnetwork applications to run in combination with a detection mechanismthat can detect, act upon and report unauthorized intrusions into theisolated environment.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 is a block diagram of an architecture of an aspect of anembodiment of the present invention.

FIG. 2 is a block diagram of an architecture of an alternativeembodiment of the present invention.

FIG. 3 is a block diagram of directories to construct container 101running Firefox as per an aspect of an embodiment of the presentinvention.

FIG. 4 is a block diagram of a unified file system for a container asper an aspect of an embodiment of the present invention.

FIG. 5 is a graph showing experimental hard disk usage using an aspectof an embodiment of the present invention.

FIG. 6 is a graph showing experimental memory usage using an aspect ofan embodiment of the present invention.

FIG. 7A shows startup delay measurements using an aspect of anembodiment of the present invention.

FIG. 7B shows throughput measurements using an aspect of an embodiment.

FIG. 7C shows results of detecting malicious downloads from websitesusing an aspect of an embodiment.

FIG. 8 is diagram of a system 800 for detecting malicious software on anetwork 901 as per an aspect of an embodiment of the present invention.

FIG. 9 is a block diagram of an application processor as per an aspectof an embodiment of the present invention.

FIG. 10 is a block diagram of a detection module as per an aspect of anembodiment of the present invention.

FIG. 11 is a diagram of an example display from a VM control console asper an aspect of an embodiment of the present invention.

FIG. 12 is a diagram of an example host operating system display showinga display for a VM control console as well as projected displays forword processing application, an email application, and a browserapplication, applications running in three containers as per an aspectof an embodiment of the present invention.

DETAILED DESCRIPTION OF EMBODIMENTS

Embodiments of the present invention provide a clean and isolatedenvironment for network applications and instances of networkapplications by using two levels of virtualization technologies.Embodiments ensure the network applications always start in a cleanenvironment and restore the environment to its pristine state oncemalicious software is detected. A detection mechanism runs outside oflight-weight virtualization to detect the intrusions. Some embodimentssupport diverse network applications, such as web browser, email client,instant messaging and so on. Evaluations of realized embodiments haveshown show that they can prevent network attacks with low overhead andthat users do not need to sacrifice performance for security.

To protect intra and inter-application attacks from the Internet,embodiments of the present invention uses a system architecture, calledInternet Cleanroom which creates a clean virtual environment, called aCleanroom, on-demand for the applications and instances of applicationswith low overhead and acceptable performance. Internet Cleanroom wasdesigned with the following properties in mind: being able to isolateevery instance of applications; being able to isolate differentapplications; ensuring that the Cleanroom is always clean; and providingusage transparency.

Being able to isolate every instance of applications: Every instance ofan application may have its own Cleanroom. This can preventintra-application attacks. It can be especially important for webbrowsers, so that a user can run different web applications such ason-line banking and on-line gaming in different Cleanrooms. Even if theon-line gaming website contains some malicious contents, it will notaffect the on-line banking session.

Being able to isolate different applications: This property preventsinter-application attacks. With Internet Cleanroom, differentapplications run in their own Cleanrooms. Embodiments build virtualenvironment for browser, office and email client respectively, and mayadd other applications. In the office Cleanroom, there is no browserinstalled, so that the risks for inter-application attacks areminimized.

Ensure the Cleanroom is always clean: This property may be achievedusing a detection mechanism (such as an anomaly detection mechanism) todetect unauthorized changes to the Cleanroom. Since the initial state ofthe Cleanroom is provided, the system knows what the clean state is andmay assume that anything else is potentially malicious. This methodshould detect day zero attacks that will be missed by signature baseddetection mechanism. Once unauthorized changes are detected, theCleanroom may be restored to its pristine state to easily remove themalware. At the same time, persistent storage may be provided for theCleanroom to let the user save data persistently. Semi-persistentstorage may also be provided to keep normal configuration dataautomatically, such as browser bookmarks.

Provide usage transparency: This property may be achieved by deployingan Internet Cleanroom such that it is tightly integrated into the user'sdesktop. The user experience while using the system may be the same asor very close to the standard desktop environment.

These properties are intended to make sure that exploit to oneapplication will not affect other applications and the host. Complexapplications such as a browser may be divided into multiple instancesand separated from each other. Also, the virtual environment may beinitialized to a clean state and restored to this clean state onceunauthorized changes are detected.

Contributions of current embodiments of the present invention include asystem architecture which has the following properties: 1) a strongisolation between Internet applications and the host OS; 2) support thecommercial Internet applications so that user can still use theirfavorite applications; 3) deployment on commercial operating systems; 4)a detection module to detect unauthorized changes, and 5) tightintegrate into a users' desktop.

A prototype embodiment 200 was built to demonstrate an embodiment of thepresent invention. It used VMware workstation (available from VMWAREInc. of Palo Alto, Calif. on Windows XP (available from Microsoft Corp.of Redmond, Wash.) as hardware level virtualization to separateapplications from the host OS. It also used OpenVZ for Linux (availablethrough on the web at “openvz dot org”) as light weight virtualizationthat runs on top of the VMware virtual machine to separate differentapplications and instances of applications. Thus, this prototypeembodiment showed that the Internet Cleanroom not only provided a strongisolation between Internet applications and the user's desktop but alsois scalable to a multitude of applications running at the same time. Theprototype embodiment 200 also included an anomaly detection module tomonitor the state of the Cleanroom. Once it detected unauthorizedchanges, it alerted the user to restore the Cleanroom to its pristinestate. Security and performance of the Internet Cleanroom wereevaluated. In 2000 malicious websites that compromised a normal Windowsoperating system, none of them compromised the prototype embodiment 200,and the performance of the prototype embodiment 200 was acceptable.

This section describes virtualization technologies that may be used toimplement embodiments of the present invention, including: VMwareworkstation and OpenVZ, and stackable file system—aufs.

There are different levels of virtualization technologies, from thelowest hardware level virtualization such as VMware Workstation and Xen(available on the web at “zen dot org”), to operating systemvirtualization as OpenVZ (available on the web at “openvz dot org”) andSolaris Zones (available from Sun Microsystems, Inc. of Santa Clara,Calif.), to process virtualization as Java virtual machine. Hardwarelevel virtualization virtualizes hardware resources (CPU, memory andhard disk etc) so that it can run Linux on top of Windows OS. Thesoftware layer may provide virtualization called a virtual machinemonitor or hypervisor. A hypervisor can run on bare hardware (Type 1 ornative VM) or on top of an operating system (Type 2 or hosted VM). Oneembodiment uses VMware workstation, a Type 2 VM for Internet Cleanroom.The OS running inside the virtual machine is called the guest OS, andthe original OS is called host OS. The virtual machine monitor providesthe separation between the guest OS and the host OS. So even if theguest OS kernel is compromised, the malware will still need to penetratethe virtual machine monitor to infect the host OS. This property iscalled strong isolation.

The OS level virtualization virtualizes the resources on an operatingsystem level. It may use a single OS kernel to provide an illusion ofmultiple operating systems for the user level applications. Each iscalled a virtual environment (VE) or a container. All the containers andthe host may share the single kernel. The OS kernel may provideseparation between different containers and between the containers andthe host. An advantage of OpenVZ and other operating systemvirtualization solutions is the performance when compared to hardwarevirtualization, because they do not require a hypervisor instructiontrapping or a separate kernel. A disadvantage may be that all thecontainers may share a single kernel and if the kernel crashes or iscompromised, then all the VEs may be compromised.

Stackable file system, unionfs and aufs will now be discussed. Unionfswas first presented by researchers at Stony Brook University. It is astackable file system on Linux that can merge a set of directories(called branches) into a single logical view. Each branch has a priorityand may be read-only or read-write. While the highest priority branch iswritable, Unionfs provides copy-on-write semantics for read-onlybranches. Aufs (available on the web at aufs “aufs dot sourceforge dotnet”), is an open source project which shares the basic features ofUnionfs but is re-designed and re-implemented to be more reliable.

For example, suppose there are three directories, named rr, ww and zz.Rr contains file r, ww contains file w and zz is empty. Next mount rr asread-only and ww as read-write to zz; the zz directory then contains rand w file (the union view of rr and ww directory). If a new file iscreated inside zz directory, it will also show up in ww directory toobecause it is read-write. If one writes to r file which is inside aread-only layer, unionfs (or aufs) system will copy it to read-writerlayer (ww) and write to it.

Aufs may be used to create containers on-the-fly. Further details arediscussed later in this disclosure.

A goal of embodiment(s) of the present invention is to seamlesslyvirtualize vulnerable network applications and their instances inpristine single-use operating systems, while providing data persistenceas required. To achieve this, a virtual environment is provided fornetworked applications while re-directing local executions of networkedapplications to the virtual environment. The virtual environment may bepre-configured for each network application and instances ofapplication. Requirements and a design of an embodiment will now bedescribed.

There are different levels of virtualization technologies, from thelowest hardware level virtualization such as VMware Workstation and Xen,to operating system virtualization as OpenVZ and Solaris, to processvirtualization as Java virtual machine. Normally, the lower the level isthe stronger isolation it can provide. On the other hand, the higherlevel tends to have lower overhead than the lower level. For thecurrently described embodiment, it was desired to have both strongisolation properties to protect the user's desktop and applications 170and also a low overhead to run a multiple of applications (161, 162, . .. 169) on one physical machine 110. (See FIG. 1). So. an operatingsystem (OS) level virtualization may be run on top of hardwarevirtualization 130. Thus, the hardware level virtualization 130 providesstrong isolation between network applications (161, 162, . . . , 169)and the host OS 120, and the OS level virtualization (151, 152, . . . ,159) provides isolation between different applications (161, 162, . . .169) and a guest OS 140 with lower virtualization overhead. In thisembodiment, there is only one hardware virtual machine (VM) 130 runningand many OS level virtual environments (151, 152, . . . , 159) calledcontainers running on top of VM 130. Each application (161, 162, . . . ,169) runs inside a container.

Referring to FIG. 2, a further discussion of an architecture of analternative embodiment that enables on-demand virtual machine creationwill now be discussed. To ensure a clean environment, every time a userstarts a network application (261, 262, 263, . . . , 269) from a host220, a new container (251, 252, 253, . . . , 259) may be created for itand the application (261, 262, 263, . . . , 269) started in the newcontainer (251, 252, 253, . . . , 259). The new container (251, 252,253, . . . , 259) may be created from a clean container template built270 with just the software required for the designated application. Forexample, a browser such as Mozilla Firefox can be run on a relativelysmall distribution of Linux container. Xserver may be used to projectthe display of the application to the Windows host 220 and hide thevirtual machine window. Since the user never interacts with the OS inthe container (251, 252, 253, . . . , 259), even Windows users who maynot be comfortable with Linux do not need to interface with theunderlying Linux system. Using diverse operating systems also providesadditional security benefits. Exploits that work against Firefox runningon Windows in many cases will not implant on Firefox running on Linux.The use of OS level virtualization allows fairly fast creation ofmultiple containers (251, 252, 253, . . . , 259) for each application(261, 262, 263, . . . , 269) and a low overhead. In addition, thecontainer template 270 may be kept offline so that it does not getcompromised. Corruptions introduced in an online session may bediscarded after the session terminates or when unauthorized changes aredetected. Any malicious software downloaded during the session or anyhackers present during the session are discarded with a container (251,252, 253, . . . , 259). Next time the application is started, a pristinecontainer (251, 252, 253, . . . , 259) may be instantiated to provide aclean environment for the application container (261, 262, 263, . . . ,269), hence its designation as a single use operating system.

The detection module 280 will now be discussed. The function of thedetection module 280 is to detect any unauthorized changes inside acontainer (251, 252, 253, . . . , 259). Although strictly speaking, thedetection module 280 may not be needed, it can be useful for providinginformation to the user if a container (251, 252, 253, . . . , 259) hasbeen infected. Since the container (251, 252, 253, . . . , 259) for eachapplication container (261, 262, 263, . . . , 269) may be preconfiguredand customized, it is feasible to use anomaly detection to detect anyunauthorized changes. Other types of change detection may be used. Inaddition, the detection module 280 may exclude legal changes such as thecache and cookies generated by the browser applications. Onceunauthorized changes are detected, the user may be notified to discardthe current container (251, 252, 253, . . . , 259) and create a new one.This step could be automated so that a user is not relied upon to keep aCleanroom clean.

Persistent Storage 275 will now be discussed. Normally, the wholecontainer (251, 252, 253, . . . , 259) is usually discarded after itsusage, no information is kept for that container (251, 252, 253, . . . ,259) after it terminates. This may cause some problems if the user wantsto save some data from the current session, such as downloaded documentsfrom the browser. To address this issue, the concept of persistentstorage 275 is introduced for temporary containers (251, 252, 253, . . ., 259). Persistent storage 275 may be set up as a shared directory onthe file system of a host operating system 220 or a networked filesystem for the user to store documents linked to the temporarycontainers (251, 252, 253, . . . , 259). To address the securityrequirement that malicious code or intruders in the containers (251,252, 253, . . . , 259) not be granted unfettered access to the hostoperating system 220, the portion of the host operating system 220visible to the container (251, 252, 253, . . . , 259) may be restrictedto only to the persistent storage directory 270. This should limit theaccess of a malicious or compromised container (251, 252, 253, . . . ,259) to only the persistent storage directory 275. However, since thecontainer (251, 252, 253, . . . , 259) has visibility to this directory,the contents of this directory may be made to be short-lived by movingany files stored in the directory to permanent storage on the user'shost machine 210, for example in the user's My Documents profiledirectory.

This approach ensures users can save documents from the temporarycontainers (251, 252, 253, . . . , 259) on to the host machine 210 in atemporary location while not exposing the rest of the host operatingsystem 220 to untrusted containers (251, 252, 253, . . . , 259). Usersdefine the locations of the temporary and permanent directories forpersistent storage 275.

Browser containers and semi-persistent storage will now be discussed.Normally, one application corresponds to one container, such as emailclient, instant messaging and office applications. But some applicationssuch as browser applications may be separated into multiple containersbecause the browser can be used for different purposes. Two classes ofbrowser applications may be distinguished, one class is private orfinancial related, such as on-line banking. The other class is publicand non-financial related, such as reading news. One container may beprovided for all the public browsing activities while providingindividual containers for every link belonging to private browsing. Theprivate containers may be pre-configured and have their own directoriesfor cookies, history and browser passwords. This process can preventcross-site scripting on the client side, because the malicious links,which come from public containers, run in a different container from theprivate links and has no information about cookies and history ofprivate links. These are called private links security bookmarks and maybe used to ensure that the public containers do not visit these securitybookmarks.

Residual risks/mitigations will now be discussed. The disclosed approachdepends on the assumption that malware won't escape the container andthe virtual machine and execute on the host OS 220 directly. The OSlevel virtualization layer provides and enforces separation betweenprocesses (261, 262, 263, . . . , 269) assigned to the container (251,252, 253, . . . , 259). The hardware level virtualization providesadditional separation between the containers (251, 252, 253, . . . ,259) and the host operating system 220. If the implementation of the OSlevel virtualization is flawed, the malware may compromise othercontainers (251, 252, 253, . . . , 259) and the virtual machine 230,which is the host for all the containers (251, 252, 253, . . . , 259).If the implementation of hardware level virtualization is flawed, it maybe possible for a guest process to access memory of host processes. As aresult, the separation and memory management of the virtualization layermay be a lynchpin for the isolation properties of the virtualization. Ina similar vein, many virtualization solutions offer a set ofvirtualization services, such as the ability to share directories,access hardware I/O devices, copy and paste between windows, amongothers. These services are the common target of malicious guestprocesses to obtain privileges on the host, also known as “escaping theVM.” In these cases, Internet Cleanroom may not protect the host.

What is important to consider in this discussion is the frequency ofthese vulnerabilities being found. A risk management approach is todeploy technologies that are not necessarily infallible, but less likelyto be defeated. The attack surface area, or the space of vulnerabilitiespresented to attackers, attributable to the virtualization-basedsolution is significantly less than that presented by buggy applicationsand operating systems. The reason is the interface to the virtualizationsoftware is highly constrained compared to the interface presented byapplications and the operating system. As a result, the frequency withwhich vulnerabilities will be presented to attackers will besignificantly less in virtualization software compared to those ofapplications. Of course only time will reveal the actual frequencydistribution. Prior history, however, shows orders of magnitude ofdifferences in these two types of vulnerabilities, i.e., thousands ofvulnerabilities of high severity in applications and operating systemsper year vs. single digit vulnerabilities in virtualization software.

In this section, an embodiment is disclosed for a Microsoft® Windows XPhost 220 and a Linux guest 240. VMware workstation may be used forWindows, and OpenVZ run for the Linux inside the VMware virtual machine.The three major components are the VM control console 292, detectionmodule 280 and a container control module 291. The VM control console292 runs on the Windows host 220 and is configured to start and stop theVMware VM 230. The container control module 291 does the similar thingfor containers (251, 252, 253, . . . , 259), and is configured to createcontainers (251, 252, 253, . . . , 259) on-the-fly. The detection module280 monitors file changes of a container (251, 252, 253, . . . , 259).It runs outside the container (251, 252, 253, . . . , 259) to resist theattacks inside the container (251, 252, 253, . . . , 259). Following aredesign details of each component.

The VM control module 292 uses VMware VIX API to start, stop and revertthe VM. It accepts user input and communicates with container controlmodule 291 when it is necessary to create a new container (251, 252,253, . . . , 259). From the Windows host 220, VMware VM is just oneprocess. Windows host 220 should not access the files in the VMdirectly. Next, Ubuntu and OpenVZ may be installed inside the VMware VM.Since OpenVZ is an operating system level virtualization, Linux host caneasily use 1s and ps command to access files and processes inside acontainer (251, 252, 253, . . . , 259).

Container control module 291 may be a perl script which receives messagefrom VM control module 292 and use aufs to create containers (251, 252,253, . . . , 259) on-the-fly. FIG. 3 shows directories to constructcontainer 101 with Firefox. There are mainly four directories: 1)Ubuntu+Firefox 310: this directory 310 contains system files and thepre-configured application (Firefox in this example) for a container. Itis mounted as read-only by using aufs, so that the malware insidecontainer cannot change it. 2) PS-SPS 320: this contains both persistentstorage (PS) 324 for downloading files and semi-persistent storage (SPS)322 for cookies, bookmark and history. They are mounted normally asread-write. 3) directory 330 101-cache is an initially empty directory.It is mounted as read-write and is used for all the other writes. Afterthe container 101 (340) is terminated, 101-cache 330 may be removed sothat any changes, including malicious changes will be removed. 4) 101(340) is the mount point for all the previous directories.

FIG. 4 shows the unified directory 450 by using aufs. 101 is the rootdirectory for the container 101. The applications running insidecontainer 101 treat the underlying file system as a normal one and reador write to it. Aufs ensures that it only writes to the writable layerand cannot change read only layer. Another advantage of aufs is that theread-only layer can be shared by multiple containers. In fact,Ubuntu+Firefox may be separated into two separate directories, so thatUbuntu directory is shared among all the running containers.

The detection module 280 will now be discussed. Detection module 280runs on the Linux host 240, outside the container. It may be anotherperl script which periodically scans the 101-cache directory and uses anexclusion list to exclude normal file changes such as when the containeris booted up. Anything else may be treated as an unauthorized change.Once changes are detected, the detection module 280 may generate analarm message and send it to the VM control console 292 to alarm theuser.

Persistent storage 275 and semi-persistent storage will now bediscussed. Persistent storage 275 may be used for the user to save filedata persistently, such as downloaded files. To provide usagetransparency, VMware shared folder feature may be used to allow the useraccess to files in the PS from the Windows host 220. All the containers(251, 252, 253, . . . , 259) may share the same PS directory, so that adocument file downloaded by a Firefox container can be opened by anOpenOffice container.

Semi-persistent storage may also be used and is also persistent so thatfiles in it will survive a container termination. The difference of SPSfrom PS is that SPS may be used for application specific configurationor preferences files which the user does not modify and save directly.Typical examples of SPS are the cookies, bookmarks, passwords andhistory of a Firefox browser. The user may add bookmarks and let thebrowser remember the passwords through the Firefox GUI. The files forthese settings may be determined and then put it into SPS.

Public browsers and secure bookmarks will now be discussed. As mentionedearlier, private container(s) may be provided for link(s) in a securebookmark folder and a public browser container for public browsing. Allthese browser containers may share a single PS. For SPS, each privatecontainer may have its own SPS, so that the sensitive cookies, historyand password are not shared between containers. Special icons may besetup for each private link on the user's Windows desktop, to enable theuser to just double click the special icon to ensure a private browsingsession.

Experimental evaluation results of a prototype embodiment 200 are nowdisclosed. The evaluation contains two parts: 1) the overhead andperformance and 2) the effectiveness of the prototype embodiment 200against some common attacks for browsers.

The test-bed was a Dell Dimension 9200 workstation, with Dual-core 2.4GHz CPU and 2 GB memory. For the prototype embodiment 200, it had onevirtual machine installed with 256 MB virtual memory and 1 GB virtualhard disk. The host OS 220 was Window XP home edition, and the guest OS240 was Ubuntu server 7.10. In the Ubuntu, OpenVZ was installed and twocontainer templates 293 built, one for public browsing with Firefox, andthe other for OpenOffice.

The prototype embodiment 200 was compared to a native application and apure VMware VM (VVM) process which use a virtual machine for eachapplication. For VVM process a basic virtual machine was first createdthat takes 719 MB disk space and 128 MB memory. A VMware linked cloneprocess was then used to create a small clone of the basic operatingsystem. Linked clone means the new virtual machine uses the originalvirtual hard disk and only saves the difference to a new virtual harddisk. This process did not need to copy the entire hard disk for everyVM.

The overhead of hard disk. For the prototype embodiment 200, the initialVM took a 1 G hard disk which contained Ubuntu, an OpenVZ template forthe browser container and an OpenOffice container. Every new containerconsumed used very few bytes of hard disk on the Windows host becausethe prototype embodiment 200 used aufs to share the basic operatingsystem as read-only among all the containers. The small increase such asnew files generated as container bootups did not incur more hard diskusage on the Windows host.

For the VVM process, each virtual machine generated a .vmem file withthe same size as the physical memory (128 MB in this test) of thevirtual machine, so it took 144M (128+16) for each virtual machine. The16 MB disk space was the new virtual hard disk. This number could haveincreased if the virtual machines keep using and the user downloads bigfiles. The result is shown in FIG. 5. When only one VM or one container(inside a VM) is needed, the VVM process was better than the prototypeembodiment 200, because it did not need to install OpenVZ and thecontainer templates. As the number of containers of VMs or containersincreased, the VVM process increased much faster than the prototypeembodiment 200 and exceeded the prototype embodiment 200 when the numberof VMs or containers was bigger than four.

Second, the memory usage was measured. The result is shown in FIG. 6 andthe trends are similar to the hard disk usage. The memory usage for eachVMware VM is significant; every VM took more than 128 MB memory. Incontrast, the memory usage for the prototype embodiment 200 kept at astable level because it could effectively share the memory betweendifferent containers. The native Firefox browser showed a similar trendas the prototype embodiment 200 with a lower overhead.

Third, the maximum number of concurrent Firefox applications was testedwith each of Firefox applications residing in its own container in theprototype embodiment 200 or VM in the VVM process. For the prototypeembodiment 200, twenty containers, each of them running a Firefoxbrowser, were started. The memory usage on the host remained the same at297 MB. As more memory was allocated to the underlying VM, morecontainers and Firefox could be started. For the VVM process, it waspossible to start fifteen virtual machines with Firefox at the same timeand the memory usage on the host was almost exhausted.

The startup delay for starting the Firefox browser in different setupswas measured, the results of which are shown in the table labeled FIG.7A. For the prototype embodiment 200, since it was expected that theuser would start public browser instances frequently, a containerrunning in the background was pre-started. When the VM control console292 received input that the user wanted to start a public browserinstance, the VM control console 292 passed the message to the containercontrol module 291 and the container control module 291 started aFirefox browser from the already started container. The average time forthis operation was 2.9 seconds. In other cases, if the virtual machinewas not running, the prototype embodiment 200 needed to start the VMwarevirtual machine (it is in fact a revert operation), and start theFirefox. This operation took an average of 14.2 seconds.

For the VVM process, the warm-start Firefox meant that the virtualmachine was running and that the user wanted a new clean virtual machinefor Firefox. The VVM process then reverted the virtual machine andstarted a new Firefox. This took an average of 9.1 seconds, which was 3times longer than specializing a pre-configured browser. For acold-start Firefox, the file cache was not warm and took an average of23.2 seconds, which was 1.6 times longer than to revert the VM and starta browser in the prototype embodiment 200.

The last two rows in the FIG. 7A shows the start delay for nativeFirefox browser running on Windows. For a warm-start Firefox browser, ittook 1.5 seconds, 51% of specializing a pre-configured browser instancein the prototype embodiment 200. The cold-start Firefox took 9.2seconds.

To measure network throughput, a 3 GB large file was downloaded and theoutput redirected to /dev/null to remove the bottle neck of therelatively slow hard disk. The tests were repeated three times and theresults averaged. Also, to minimize the effect of variability in networktraffic between tests, the server and the client were both on a localnetwork. The results are shown in the table labeled FIG. 7B. During thetest, only one container and one VM was started. VMtools was alsoinstalled inside the testing VM. For the prototype embodiment 200, wgetwas run inside the container (which is running inside a VM); for VVM,wget was run inside a virtual machine.

FIG. 7B shows that the throughputs of both the prototype embodiment 200and the VVM were close to that of the native Windows. The prototypeembodiment 200 was slightly faster than VVM. This was attributed this tothe fluctuation of the network.

To evaluate the security of the prototype embodiment 200, both a browserrunning on the prototype embodiment 200 and a native Firefox browser onWindows were run to visit a set of potential malicious websites. For theprototype embodiment 200, the detection module 280 was used to detectwhether there was a malicious download. For native Firefox on Windows,Capture honey client was used to detect unauthorized changes. Theresults are shown in the table labeled FIG. 7C. In the total of 2000 websites that were visited, six of them performed a drive-by download onnative Windows Firefox, and none of them downloaded files to theprototype embodiment 200. One possible reason for no downloads on theprototype embodiment 200 is that Firefox was running on Linux and Linuxis a small target compared with Windows. In addition, even if themalware exploited the vulnerabilities of Firefox, it still needed tofind the vulnerabilities of OpenVZ and VMware Workstation. So thechances for success were very small compared to a native application.

So far, a system to protect the network applications by running eachapplication or instance of application in its own virtual environmentsandbox was disclosed. A prototype which uses two levels ofvirtualizations and provides both a strong isolation and a small runningoverhead was built and described. By running OS level virtualization(OpenVZ) on top of hardware level virtualization (VMware workstation),the disk and memory overhead for hardware level virtualization wassignificantly reduced. In addition, a detection module was used todetect the unauthorized changes for each container so that it waspossible to know when to destroy the sandbox and start a new one. Theoverhead and performance of the prototype embodiment 200 was comparedwith a pure virtual machine based process and the native application.The results show that the prototype embodiment 200 is more scalable innumber of sandboxes than a pure virtual machine process and that theperformance is acceptable.

Additionally, the detection module may be to detect malicious processand memory-only changes. Addition, connections between private browsersand the public browser may be restricted.

FIG. 8 is diagram of a system 800 for detecting malicious software on anetwork 901 as per an aspect of an embodiment of the present invention.In the system 800 as shown, embodiments of the application processors810 (shown individually as 811, 812, 813, . . . , 819) are widelydistributed throughout a network 901 such as the Internet. Theseapplication processors 810 act as widely distributed honey clients. Theymay be configured to allow diverse users to drive their applicationprocessor 810 in the distributed honey client. In other words, thedistributed honey client interacts with the network 901 exactly the wayusers interact with the network because the application processors 810are driven by the user of the network 901. Each of the distributedapplication processors 810 act as a canary since at least some of themare likely to be subjected to new cyber attacks when they first appear.

Each of the distributed application processors 810 include virtualizednetwork applications such as a web browser. The user drives theseapplications. When it is determined that a virtualized application hasbeen compromised, the activity that lead to that compromise may berecorded and the application killed (i.e. the canary dies) and may thenbe restored to a pristine state. The recorded activity 820 (shownindividually as activity reports 921, 922, 923, . . . , 929) is sentthrough the network 901 to a central collection network appliance 830where they can be stored in a repository of activities for infecteddevices 840. This system, when operated with a large number ofdistributed application processors 810 should enable the collection ofstatically significant results, including malicious URL's.

The central collection network appliance 830 may be configured toanalyzes activity report(s) 820. Among other items, the analysis may bedetermine many types of useful data points, metrics and otherinformation such as new trigger events and filter data 845. These newtrigger events and filter data 845 may be downloaded for use bydistributed application processor(s) 810. This collected information 845may be used to update more traditional cyber security mechanismsthroughout the network 901 such as firewalls, virus protection softwareor network traffic appliances. Examples of network traffic appliancesinclude TPC/IP filters and routers, hardware firewalls and networkintrusion systems.

FIG. 9 is a block diagram of an application processor 900 as per anaspect of an embodiment of the present invention. The applicationprocessor 900 includes a virtual machine monitor 916, at least onecontainer (951, 952, . . . , 959), a detection module 930, a virtualmachine control console 914, a container control module 934 and anetwork communications module 936.

The virtual machine monitor is configured to operate on a hardwarecomputing machine under control of a host operating system.

Containers (951, 952, . . . , 959) are preferably configured to operatein a protected memory space (941, 942, . . . , 949) under control of aguest operating system virtual machine 932. When created each of thecontainers (951, 952, . . . , 959) may be initialized with a copy of anetwork application template 920. Each of the network applicationtemplate(s) preferably includes a modifiable section 922 and anon-modifiable section 924. Additionally, each of the containers (951,952, . . . , 959) may be configured to have a file system (971, 972, . .. , 979) and a network address (961, 962, . . . , 969).

There can be several types of containers. For example container may beprivate or public. Private containers may be configured to have privatesemi-persistent storage. Public containers may be configured to accesspersistent storage.

Container(s) (951, 952, . . . , 959) may reside in many locations. Forexample, Container(s) (951, 952, . . . , 959) may reside locally on thecomputing hardware 910, or on external storage mediums such as a flashdrive.

To minimize the probability of a successful attack on the applicationprocessor, it may be advantageous to configure the guest operatingsystem 918 and host operating system 912 differently. For example, inone embodiment, the host operating system 912 may be windows and theguest operating system 918 may be Linux. Likewise, another embodimentmay use OSX as the host operating system 912 and windows as the guestoperating system 918.

The detection module 930 is preferably configured to operate undercontrol of the guest operating system virtual machine 932. FIG. 10 is ablock diagram of a detection module 930 as per an aspect of anembodiment of the present invention. As shown, the detection module 930includes a trigger detection module 1020, a logging module 1040, and acontainer command module 1060.

The trigger detection module 1020 is preferably configured to monitoractivity 1010 from container(s) for a trigger event 1030. Trigger eventsmay include, but not limited to: unauthorized changes to the anon-modifiable section; registry writes; the start of new processes; websites visited; redirected URL's; infection details; event timelines;network connections; file system writes; and configuration changes.

The logging module 1040 is preferably configured to write activity 1010to an activity report(s) 1050 in response to the trigger event 1030.Activity report(s) 1050 may include, but are not limited to:unauthorized changes to the a non-modifiable section; registry writes;the start of new processes; web sites visited; redirected URL's;infection details; event timelines; network connections; file systemwrites; and configuration changes. The logging may correlateunauthorized events with URLs. The logging module 1040 may correlatechanges to the current opening or last visited URL(s). The activityreport may be searchable by many variables including, but not limitedto: MD5 hash values; time intervals; web sites; hosts; process names;and remote connections.

The container command module 934 is preferably configured toconditionally issue container commands 1060 in response to the triggerevent(s) 1030. The container commands 1060 include, but are not limitedto, container stop commands, container revert commands and containerstart commands.

The virtual machine control console 914 is preferably configured tooperate under control of the host operating system 912 and to start andstop the hardware virtual machine monitor 916. FIG. 11 is a diagram ofan example display from a VM control console 914 as per an aspect of anembodiment of the present invention. The display may be hidden or shownon the display of the host operating system 912. As shown, the displayof the VM control console 914 shows the health status of the virtualmachines. Mouse over details may be applied to allow a user to examinedetails about each application (981, 982, . . . , 989). Variousparameters may be shown on the display including, but not limited to:time of exposure, and rootkit/malware detection. Controls may beprovided to give a user the ability to: clean a machine. The cleaningoperation command may restore a container back to a pristine state,either on-demand or on a schedule. Additional controls may includecreate new machines on demand and destroy machines.

To make the application processor 900 user friendly, it may beadvantageous to make several configurations to minimize the fact thatapplications (981, 982, . . . , 989) are being run in containers (951,952, . . . , 959). For example, the application processor 900 may beconfigured to have the container output displayed by the host operatingsystem 912. Likewise, virtual machine windows may be hidden. FIG. 12 isa diagram of an example host operating system display 1200 showing adisplay 1210 for a VM control console 914 as well as projected displaysfor word processing application 1220, an email application 1230, and abrowser application 1240, applications running in three containers.

The container control module 934 is preferably configured to operateunder control of the guest operating system virtual machine 932. Thismodule should execute the container commands. For example, it shouldstart a container in response to a container start command, stop acontainer in response to a container stop command and to revert acontainer in response to the container revert command. Containercommands can come from multiple sources including the detection module930 or the host operating system 912. The source of commands may beexplicitly limited to enhance security.

The network communications module 936 is preferably configured totransmit activity reports (such as 921, 922, . . . , 929) over network901.

Additionally, the application processor 900 may include a sharedpersistent directory 938 configured to operate under control of the hostoperating system 912. This shared directory may be set to accessible byselect container(s) (951, 952, . . . , 959). In some embodiments, accessto the shared directory 938 may be limited.

In this specification, “a” and “an” and similar phrases are to beinterpreted as “at least one” and “one or more.”

Many of the elements described in the disclosed embodiments may beimplemented as modules. A module is defined here as an isolatableelement that performs a defined functions and has a defined interface toother elements. The modules described in this disclosure may beimplemented in hardware, software, firmware, wetware (i.e. hardware witha biological element) or a combination thereof, all of which arebehaviorally equivalent. For example, modules may be implemented as asoftware routine written in a computer language (such as C, C++,FORTRAN, Java, Basic, Malta or the like) or a modeling/simulationprogram such as SimuLink, Stateflow, GNU Octave, or LabVIEW MathScript.Additionally, it may be possible to implement modules using physicalhardware that incorporates discrete or programmable analog, digitaland/or quantum hardware. Examples of programmable hardware include:computers, microcontrollers, microprocessors, application-specificintegrated circuits (ASICs); field programmable gate arrays (FPGAs); andcomplex programmable logic devices (CPLDs). Computers, microcontrollersand microprocessors are programmed using languages such as assembly, C,C++ or the like. FPGAs, ASICs and CPLDs are often programmed usinghardware description languages (HDL) such as VHSIC hardware descriptionlanguage (VHDL) or Verilog that configure connections between internalhardware modules with lesser functionality on a programmable device.Finally, it needs to be emphasized that the above mentioned technologiesare often used in combination to achieve the result of a functionalmodule.

The disclosure of this patent document incorporates material which issubject to copyright protection. The copyright owner has no objection tothe facsimile reproduction by anyone of the patent document or thepatent disclosure, as it appears in the Patent and Trademark Officepatent file or records, for the limited purposes required by law, butotherwise reserves all copyright rights whatsoever.

While various embodiments have been described above, it should beunderstood that they have been presented by way of example, and notlimitation. It will be apparent to persons skilled in the relevantart(s) that various changes in form and detail can be made thereinwithout departing from the spirit and scope. In fact, after reading theabove description, it will be apparent to one skilled in the relevantart(s) how to implement alternative embodiments. Thus, the presentembodiments should not be limited by any of the above describedexemplary embodiments.

In addition, it should be understood that any figures which highlightthe functionality and advantages, are presented for example purposesonly. The disclosed architecture is sufficiently flexible andconfigurable, such that it may be utilized in ways other than thatshown. For example, the steps listed in any flowchart may be re-orderedor only optionally used in some embodiments.

Further, the purpose of the Abstract of the Disclosure is to enable theU.S. Patent and Trademark Office and the public generally, andespecially the scientists, engineers and practitioners in the art whoare not familiar with patent or legal terms or phraseology, to determinequickly from a cursory inspection the nature and essence of thetechnical disclosure of the application. The Abstract of the Disclosureis not intended to be limiting as to the scope in any way.

Finally, it is the applicant's intent that only claims that include theexpress language “means for” or “step for” be interpreted under 35U.S.C. 112, paragraph 6. Claims that do not expressly include the phrase“means for” or “step for” are not to be interpreted under 35 U.S.C. 112,paragraph 6.

What is claimed is:
 1. An apparatus, comprising: a memory; and ahardware processor communicatively coupled to the memory, the hardwareprocessor configured to execute a virtual machine monitor at leastpartially stored in the memory, the virtual machine monitor configuredto provide a first level of virtualization, the hardware processorconfigured to execute a virtual environment using the virtual machinemonitor, the virtual environment configured to provide a second level ofvirtualization, the second level of virtualization operating within thefirst level of virtualization, the hardware processor configured toexecute an application within the virtual environment, access to dataassociated with a host operating system by the application beingrestricted to a shared memory configured to operate within the firstlevel of virtualization, the hardware processor configured to monitorbehavior of the application within the virtual environment, the hardwareprocessor configured to discard the virtual environment in response todetecting unauthorized activity of the application, the unauthorizedactivity including at least one of an unauthorized change to anon-modifiable section of the virtual environment, a registry write, astart of a new process, corruption to an existing process, a web sitevisited, a redirected Uniform Resource Locator (URL), an infectiondetail, an event timeline, a network connection, a file system write, ora configuration change.
 2. The apparatus of claim 1, wherein the virtualenvironment is configured to operate under control of a guest operatingsystem operating within a virtual machine defined by the virtual machinemonitor.
 3. The apparatus of claim 1, wherein the first level ofvirtualization is hardware level virtualization and the second level ofvirtualization is operating system level virtualization.
 4. Theapparatus of claim 1, wherein the virtual environment is executed withina guest operating system executing within the first level ofvirtualization, the guest operating system being a first type ofoperating system and the host operating system being a second type ofoperating system different than the first type of operating system. 5.The apparatus of claim 1, wherein the virtual environment is configuredto operate in a protected memory space.
 6. A non-transitoryprocessor-readable medium storing code representing instructions to beexecuted by a processor, the code comprising code to cause the processorto: initiate a virtual container to execute an application, the virtualcontainer providing a first level of virtualization executed within asecond level of virtualization, the application being isolated from ahost operating system by the first level of virtualization and thesecond level of virtualization, access to data associated with the hostoperating system by the virtual container is restricted to a data storeconfigured to operate within the second level of virtualization; monitorbehavior of the application within the virtual container; detect, basedon the monitoring, an unauthorized activity of the application, theunauthorized activity including at least one of an unauthorized changeto a non-modifiable section of the virtual container, a registry write,a start of a new process, corruption to an existing process, a web sitevisited, a redirected Uniform Resource Locator (URL), an infectiondetail, an event timeline, a network connection, a file system write, ora configuration change; and discard the virtual container in response todetecting the unauthorized activity.
 7. The non-transitoryprocessor-readable medium of claim 6, wherein the first level ofvirtualization is operating system level virtualization and the secondlevel of virtualization is hardware level virtualization.
 8. Thenon-transitory processor-readable medium of claim 6, wherein the secondlevel of virtualization is controlled by a virtual machine monitorexecuting on the host operating system.
 9. The non-transitoryprocessor-readable medium of claim 6, wherein the virtual container isexecuted within a guest operating system executing within the secondlevel of virtualization.
 10. The non-transitory processor-readablemedium of claim 6, wherein the virtual container is executed within aguest operating system executing within the second level ofvirtualization, the guest operating system being a first type ofoperating system and the host operating system being a second type ofoperating system different than the first type of operating system. 11.The non-transitory processor-readable medium of claim 6, wherein thevirtual container is configured to operate in a protected memory space.12. The non-transitory processor-readable medium of claim 6, whereincontents of the data store are not discarded in response to detectingthe unauthorized activity.
 13. An apparatus, comprising: a memory; and ahardware processor communicatively coupled to the memory, the hardwareprocessor configured to execute: a virtual machine to define a firstlevel of virtualization, a virtual container within the virtual machineto define a second level of virtualization within the first level ofvirtualization, and an application within the virtual container, ashared memory configured to operate within the first level ofvirtualization, access to data associated with a host operating systemby the application is restricted to the shared memory, the hardwareprocessor is configured to monitor behavior of the application withinthe virtual container, the hardware processor configured to discard thevirtual container in response to detecting unauthorized activity of theapplication, the unauthorized activity including at least one of anunauthorized change to a non-modifiable section of the virtualcontainer, a registry write, a start of a new process, corruption to anexisting process, a web site visited, a redirected Uniform ResourceLocator (URL), an infection detail, an event timeline, a networkconnection, a file system write, or a configuration change.
 14. Theapparatus of claim 13, wherein the first level of virtualization ishardware level virtualization and the second level of virtualization isoperating system level virtualization.
 15. The apparatus of claim 13,wherein the first level of virtualization is controlled by a virtualmachine monitor executing on the host operating system.
 16. Theapparatus of claim 13, wherein the virtual container is executed withina guest operating system executing within the first level ofvirtualization, the guest operating system being a first type ofoperating system and the host operating system being a second type ofoperating system different than the first type of operating system. 17.The apparatus of claim 13, wherein contents of the shared memory are notdiscarded in response to detecting the unauthorized activity.